> and PII?

Feel free to email me if that is actually the case. I can't see anything that would confirm that.

Edit: I have dug into it. No credential/secret/email leak... the complaint as "leaking PII" is not really substantiated in the dangerous sense. The only real exposure is real first+ (optional) last names (already public-by-design inside the app) being readable by unauthenticated callers. I will let him think through the implications of that instead of helicopter parenting.